KVKK Guide for Marketplace Sellers: Legal Responsibilities in E-Commerce

Marketplace sellers’ obligations under the Turkish Personal Data Protection Law (KVKK) become concrete when they gain access to customers’ order information and continue throughout the storage, sharing and deletion of data. The fact that a sale takes place through a platform does not eliminate the seller’s obligations arising from its own activities. At every stage, from preparing the order to finalising a return request, it must be determined for what purposes personal data is used, with whom it is shared and how it is protected.

What Are the KVKK Obligations of Marketplace Sellers?

A seller operating a store on a marketplace may access information such as the customer’s name, delivery address, telephone number and order history. Viewing this information in the seller panel, downloading it to a computer, transmitting it to a courier company or recording it in an accounting system constitutes personal data processing. The fact that data is not stored on the seller’s own server does not, in itself, eliminate responsibility under the KVKK.

The seller’s main obligations are to identify an appropriate legal basis for each processing activity, provide information to customers, take the necessary security measures and retain personal data only for as long as necessary. Responding to customer applications and making the necessary notifications in the event of data breaches also fall within this framework.

The distinction between an electronic commerce service provider (ETHS) and an electronic commerce intermediary service provider (ETAHS) under Law No. 6563 on the Regulation of Electronic Commerce explains the commercial positions of the seller and the platform. A seller that is a merchant or tradesperson also has a separate obligation under electronic commerce legislation to display identifying information, such as its trade name, registered electronic mail (KEP) address and relevant registry information, in the area allocated to it on the marketplace. However, this identifying information does not replace the seller’s obligation to provide information under the KVKK.

Platform or Seller? The Distinction Between Data Controller and Data Processor in E-Commerce

A data controller is the party that determines the purposes and means of processing personal data. A data processor processes data on behalf of the data controller, based on the authority granted by the latter. The capacities assigned to the parties in a contract must correspond to their relationship in practice.

The platform may be a data controller for membership management, platform security and the provision of its own services. The seller may also act as a separate data controller in respect of processing carried out to fulfil orders, issue invoices, manage returns or conduct its own customer relations. Describing one of the parties as a ‘data processor’ in the marketplace agreement does not, in itself, change this assessment based on actual decision-making authority.

For example, an outsourced call centre that records customer requests in accordance with the seller’s instructions may be a data processor for that activity. A payment institution or courier company, on the other hand, may act as a separate data controller in the context of its own regulatory obligations and the purposes it determines. It would not be correct to place all service providers in the same category.

Accordingly, when reviewing a marketplace agreement, the scope of data sharing, the parties’ duties, the referral of data subject applications and the communication arrangements in the event of a breach should be assessed together. The seller’s data inventory should not be limited to the data received from the platform; it should also cover exports from the panel, accounting and courier integrations and customer service records.

Data Processed During the Order Process and the Risk of Special Categories of Personal Data

The information processed by sellers is not limited to names and addresses. Invoice details, order numbers, product preferences, delivery notes, reasons for returns, customer correspondence and access logs relating to the seller panel may also contain personal data. It should also be separately determined which information is actually displayed to the seller during the payment process.

The nature of product preferences is also important. Not every product order automatically constitutes a special category of personal data. However, certain orders or customer statements may reveal information about a person’s health or sex life. Inferences made from this information may also give rise to a risk of processing special categories of personal data.

For example, the attachment of a medical report to a return request requires legal and technical measures different from those applicable to an ordinary customer service record. The seller should not request documents that are unnecessary for resolving the transaction and should prevent unnecessary sensitive information provided to it from spreading through its records.

Is Explicit Consent Required in E-Commerce?

Explicit consent is not a legal basis that must be relied upon in every case for all personal data processing activities. The purpose of the processing must first be identified, and it must be assessed which of the conditions under Article 5 of the KVKK may apply. A use unrelated to the order cannot be rendered lawful merely on the basis that the customer has made a purchase.

Legal bases frequently encountered by sellers include:

• Compliance with a legal obligation: Issuing invoices and keeping records required by the relevant legislation
• Establishment, exercise or protection of a right: Using order and correspondence records relating to a specific dispute
• Establishment or performance of a contract: Processing the address and contact details necessary for delivery of the product
• Legitimate interests: Conducting proportionate fraud-prevention checks, provided that the customer’s fundamental rights are not prejudiced

Each legal basis may be relied upon only in relation to data that is necessary and relevant. Legitimate interests cannot justify unlimited customer tracking; the balancing of interests must be assessed on a case-by-case basis. For special categories of personal data, the separate processing conditions under Article 6 of the KVKK and the necessary security measures must be taken into account.

KVKK Obligation to Inform and Notice Requirements for Marketplace Sellers

The general privacy or information notice published by the marketplace does not automatically cover all processing activities carried out by the seller. If the notice also explains the seller’s identity, activities and data processing operations, its scope may be assessed separately. Relying solely on a notice describing the platform’s processing activities is insufficient.

The seller’s information notice should clearly include the following:

• The purposes for which personal data is processed
• The method of collecting the data and the legal basis
• The rights of the data subject under Article 11 of the KVKK
• To whom and for what purposes the data may be transferred
• The identity of the data controller and its representative, if any

Where data is not obtained directly from the customer, the timing rules under the Communiqué on the Procedures and Principles to Be Complied with in Fulfilling the Obligation to Inform must also be observed. Information must be provided within a reasonable period after the data is obtained, at the time of the first communication if the customer is to be contacted, or no later than the time of the first transfer if the data is to be transferred.

It is important to make the relevant information notice available through a link in the store area or at the relevant transaction stage and to keep demonstrable records of access and provision of the information. Providing information and obtaining explicit consent are separate processes; the customer’s confirmation that they have seen the notice does not, in itself, mean that they have authorised every use of their data.

Data Minimisation in Invoicing, Shipping and Returns

Data required to complete an order must be distinguished from data the business wishes to collect for convenience. When providing the courier company with information necessary for delivery, it is generally unnecessary to share all correspondence with the customer or previous orders.

The information required to issue an invoice must be determined according to the type of transaction and document. Rather than routinely requesting a Turkish Republic identity number from every customer for every purchase, the specific legal requirement should be checked. Collecting an entire identity document may unnecessarily expand a need that could be met with more limited information.

A similar approach should be taken in the returns process. If a photograph showing a defect in a product includes the customer’s face, images of the interior of a home or information relating to other persons, only the necessary part should be used. Clear rules should be established concerning access to shipping labels and printed order lists in the packing area, incorrect printing of labels and the destruction of documents after use.

In its Decision No. 2022/774, the Personal Data Protection Board examined an incident in which sender, recipient, product and contact information was sent to the email address of a person who was not a party to the order. The Board found that the data security obligation had not been fulfilled because no mechanism was in place to verify the accuracy of contact information. This example demonstrates the need to verify email addresses, control authorisation for order links and restrict access to customer information.

Can Order Information Be Used for Marketing? İYS and Commercial Electronic Message Rules

A telephone number provided by a customer for delivery cannot automatically be added to the seller’s promotional campaign list. Order notifications and advertising communications serve different purposes. When assessing the conditions for data processing under the KVKK, Law No. 6563, regulations governing commercial electronic messages and the relevant obligations concerning the Message Management System (İYS) must also be taken into account.

Consent obtained by a marketplace for its own campaigns does not necessarily cover marketing carried out by the seller in its own name. It must be checked for which party, channel and purpose consent was given. Exceptions must also be applied without extending their scope.

The Personal Data Protection Board’s Principal Decision dated 10 June 2025 and numbered 2025/1072 draws attention to the misleading use of verification codes for different purposes. A code sent for a payment or membership transaction cannot be converted into marketing consent without informing the customer. Where explicit consent is required for marketing, the customer must be offered a genuine choice, and consent must not be presented as a mandatory condition of purchase.

Consent and refusal records should be kept up to date, and the customer’s communication preferences should be reflected in the relevant systems. Adding a promotional campaign to a message notifying the customer that an order has been delivered may also affect the legal character of the message.

Customer Requests and the KVKK Data Subject Application Process

Customer messages received through the marketplace should not be transferred to team members’ personal email accounts or messaging groups accessible to unauthorised persons. Sharing screenshots of order details in a messaging group set up to track returns increases the number of people with access and makes deletion more difficult.

Customer service employees should have access only to records required for their duties. When referring a request to another unit, the relevant records should be shared rather than the customer’s entire order history. Replies to publicly visible reviews should likewise not disclose the customer’s address, telephone number or order details.

A customer may apply to the seller to learn whether their personal data is being processed or to request its deletion where the relevant conditions are met. The data controller must respond to an application duly submitted as soon as possible, depending on its nature, and in any event within 30 days.

If an application is received by the platform, it should be determined which party is responsible for the relevant processing activity, and the referral should not be delayed. Identity verification should not involve collecting additional data that is unnecessary to respond to the application.

Seller Panel Security: Use of MFA and Technical Measures

Article 12 of the KVKK requires technical and organisational measures to ensure an appropriate level of security. The seller’s obligations are not limited to using the platform’s security infrastructure. The security of its own personnel, devices and downloaded records must also be managed.

Priority measures include separate accounts for each employee, role-based access authorisation, multi-factor authentication and revocation of access when an employee leaves. Bulk downloads of orders should be restricted, and the purpose, location and duration of file retention should be monitored. The use of shared passwords should cease, and necessary precautions should be taken concerning customer lists stored on personal devices and unprotected spreadsheets.

In its Decision dated 8 August 2024 and numbered 2024/1385, the Board examined access to accounts on an e-commerce platform using user credentials obtained from other sources. The breach affected 673 sellers and 7,202 customers; the detection of unusual activity and the absence of multi-factor authentication before the breach were prominent in the assessment. The decision demonstrates the direct link between the security of seller accounts and the protection of customer data.

Employee training should also be practical. The steps to be taken in incidents such as sending an invoice to the wrong recipient, receiving fraudulent platform emails and sharing screenshots containing customer information should be explained in advance.

Data Breach Management in E-Commerce and the 72-Hour Notification Rule for the Board

Sending order information to the wrong person, the compromise of a seller account or unauthorised sharing of a customer list may require a data breach assessment. As a first step, access should be restricted, relevant records preserved and the scope of the incident determined.

Where personal data is obtained by others through unlawful means, the data controller must notify the Board without delay and no later than 72 hours after becoming aware of the incident. Affected persons must also be informed as soon as reasonably possible. The Board’s Decision No. 2019/10 sets out the basic framework for this notification process.

It is important for the seller and the platform to share information about the incident promptly. The fact that the platform has made a notification does not automatically remove the need for an assessment by the seller within the scope of its own responsibilities as a data controller. Service agreements should specify to whom a breach must be reported, within what period and with what information.

Transfers of Personal Data Abroad Through Cloud Accounting and Software

Sellers may transfer orders to cloud-based accounting, customer relationship management or support systems. Purchasing the service in Türkiye does not establish that the data is processed only in Türkiye. Server locations, backup arrangements and support access from abroad should be investigated.

The agreement with a data processor should regulate the scope of instructions, confidentiality, security measures, subcontracted service providers and the return or deletion of data at the end of the service. These matters are also important in regulating the relationship between the data controller and data processor in cloud services.

The current framework under Article 9 of the KVKK applies to transfers abroad. For each transfer, an adequacy decision should first be considered; in its absence, appropriate safeguards should be considered; and where neither is available, the limited exceptions applicable only to occasional situations should be assessed. Where a standard contract is used, it must be notified to the Authority within 5 business days of signing.

As routine cloud use is not a data processing activity that can be carried out through occasional transfers under Article 9 of the KVKK, a general explicit consent statement obtained for this purpose would not be legally compliant; transfer mechanisms based on the appropriate safeguards specified in Article 9 of the KVKK would provide the proper legal basis for routine cloud use.

E-Commerce Data Retention and Destruction Processes and VERBİS Obligations

It is not appropriate to set a single retention period for all customer data. Invoices, delivery records, customer correspondence and marketing consent may be subject to different purposes and legislative provisions. Retention periods should be determined by data category and processing activity.

When the grounds requiring retention cease to exist, deletion, destruction or anonymisation procedures should be implemented. The possibility that a record might be useful in any future dispute does not justify indefinite retention. Copies downloaded from the seller panel, backups and records held by external service providers should also be included in this plan.

To establish a workable compliance framework, the seller may take the following steps:

1. Identify the data processed and the parties to whom it is transferred;
2. Record the legal basis and retention period for each activity;
3. Update information notices and necessary consent procedures;
4. Regularly review staff access permissions and data exports;
5. Assign responsible persons for applications, breaches and destruction procedures; and
6. Review the VERBİS registration obligation in light of the applicable conditions and exceptions.

Being eligible for an exemption from VERBİS does not exempt the seller from its other obligations under the KVKK. The compliance framework should be reviewed as sales volume, staff numbers, integrations used and the types of data processed change.

Marketplace KVKK Consultancy and Legal Compliance Services

In marketplace sales, the obligation to protect personal data does not end when an order is completed. Clear allocation of responsibilities, proportionate data use and regular security checks support the lawful management of customer relationships.

Esenyel Partners provides legal support in reviewing marketplace agreements, information notices, data transfer arrangements and internal company processes within the scope of personal data protection law.

You may contact Esenyel Partners to identify the KVKK obligations applicable to your marketplace sales model and develop a compliance plan suitable for your business.

Contact